Merge pull request #698 from web-token/fix/jwe-builder-shared-header-after-recipient

fix(encryption): read the recipient header from the builder state

Author: Spomky

.ci-tools/phpstan-baseline.neon

@@ -4473,7 +4473,7 @@ parameters:
 		-
 			rawMessage: Cannot access offset 'header' on mixed.
 			identifier: offsetAccess.nonOffsetAccessible
-			count: 1
+			count: 3
 			path: ../src/Library/Encryption/JWEBuilder.php
 
 		-
@@ -4494,12 +4494,6 @@ parameters:
 			count: 1
 			path: ../src/Library/Encryption/JWEBuilder.php
 
-		-
-			rawMessage: 'Cannot call method getHeader() on mixed.'
-			identifier: method.nonObject
-			count: 2
-			path: ../src/Library/Encryption/JWEBuilder.php
-
 		-
 			rawMessage: 'Method Jose\Component\Encryption\JWEBuilder::checkAndSetContentEncryptionAlgorithm() has parameter $completeHeader with no value type specified in iterable type array.'
 			identifier: missingType.iterableValue

src/Library/Encryption/JWEBuilder.php

@@ -125,7 +125,7 @@ public function withSharedProtectedHeader(array $sharedProtectedHeader): self
     {
         $this->checkDuplicatedHeaderParameters($sharedProtectedHeader, $this->sharedHeader);
         foreach ($this->recipients as $recipient) {
-            $this->checkDuplicatedHeaderParameters($sharedProtectedHeader, $recipient->getHeader());
+            $this->checkDuplicatedHeaderParameters($sharedProtectedHeader, $recipient['header']);
         }
         $clone = clone $this;
         $clone->sharedProtectedHeader = $sharedProtectedHeader;
@@ -142,7 +142,7 @@ public function withSharedHeader(array $sharedHeader): self
     {
         $this->checkDuplicatedHeaderParameters($this->sharedProtectedHeader, $sharedHeader);
         foreach ($this->recipients as $recipient) {
-            $this->checkDuplicatedHeaderParameters($sharedHeader, $recipient->getHeader());
+            $this->checkDuplicatedHeaderParameters($sharedHeader, $recipient['header']);
         }
         $clone = clone $this;
         $clone->sharedHeader = $sharedHeader;

tests/Component/Encryption/EncrypterTest.php

@@ -70,6 +70,87 @@ public function duplicatedHeader(): void
             ]);
     }
 
+    #[Test]
+    public function sharedHeaderCanBeSetAfterTheRecipientHasBeenAdded(): void
+    {
+        $jweBuilder = $this->getJWEBuilderFactory()
+            ->create(['RSA-OAEP-256', 'A256CBC-HS512']);
+        $jweDecrypter = $this->getJWEDecrypterFactory()
+            ->create(['RSA-OAEP-256', 'A256CBC-HS512']);
+
+        $jwe = $jweBuilder
+            ->create()
+            ->withPayload('FOO')
+            ->withSharedProtectedHeader([
+                'enc' => 'A256CBC-HS512',
+                'alg' => 'RSA-OAEP-256',
+            ])
+            ->addRecipient($this->getRSARecipientKey())
+            ->withSharedHeader([
+                'cty' => 'text/plain',
+            ])
+            ->build();
+
+        $token = $this->getJWESerializerManager()
+            ->serialize('jwe_json_flattened', $jwe, 0);
+        $loaded = $this->getJWESerializerManager()
+            ->unserialize($token);
+
+        static::assertSame('text/plain', $loaded->getSharedHeaderParameter('cty'));
+        static::assertTrue($jweDecrypter->decryptUsingKeySet($loaded, $this->getPrivateKeySet(), 0));
+        static::assertSame('FOO', $loaded->getPayload());
+    }
+
+    #[Test]
+    public function duplicatedHeaderWhenTheSharedHeaderIsSetAfterTheRecipient(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('The header contains duplicated entries: cty.');
+
+        $jweBuilder = $this->getJWEBuilderFactory()
+            ->create(['RSA-OAEP-256', 'A256CBC-HS512']);
+
+        $jweBuilder
+            ->create()
+            ->withPayload('FOO')
+            ->withSharedProtectedHeader([
+                'enc' => 'A256CBC-HS512',
+                'alg' => 'RSA-OAEP-256',
+            ])
+            ->addRecipient($this->getRSARecipientKey(), [
+                'cty' => 'text/plain',
+            ])
+            ->withSharedHeader([
+                'cty' => 'application/json',
+            ]);
+    }
+
+    #[Test]
+    public function duplicatedHeaderWhenTheSharedProtectedHeaderIsSetAfterTheRecipient(): void
+    {
+        $this->expectException(InvalidArgumentException::class);
+        $this->expectExceptionMessage('The header contains duplicated entries: cty.');
+
+        $jweBuilder = $this->getJWEBuilderFactory()
+            ->create(['RSA-OAEP-256', 'A256CBC-HS512']);
+
+        $jweBuilder
+            ->create()
+            ->withPayload('FOO')
+            ->withSharedProtectedHeader([
+                'enc' => 'A256CBC-HS512',
+                'alg' => 'RSA-OAEP-256',
+            ])
+            ->addRecipient($this->getRSARecipientKey(), [
+                'cty' => 'text/plain',
+            ])
+            ->withSharedProtectedHeader([
+                'enc' => 'A256CBC-HS512',
+                'alg' => 'RSA-OAEP-256',
+                'cty' => 'application/json',
+            ]);
+    }
+
     #[Test]
     public function createCompactJWEUsingFactory(): void
     {